Paper deep dive
AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs
Che Wang, Jiaming Zhang, Ziqi Zhang, Zijie Wang, Yinghui Wang, Jianbo Gao, Tao Wei, Zhong Chen, Wei Yang Bryan Lim
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 7/20/2026, 2:09:43 PM
Summary
The paper introduces AdapTools, an adaptive indirect prompt injection (IPI) attack framework designed for agentic LLMs. It addresses limitations of static attacks by using adaptive strategy construction and stealthy tool selection to bypass modern reasoning-based defenses. The framework achieves a 2.13x improvement in attack success rate and degrades system utility by 1.78x, demonstrating effectiveness against state-of-the-art defenses.
Entities (16)
Relation Signals (15)
AdapTools → contains → Adaptive Attack Strategy Construction
confidence 95% · Our approach comprises two key components: (1) Adaptive Attack Strategy Construction
AdapTools → contains → Attack Enhancement
confidence 95% · (2) Attack Enhancement, which identifies stealthy tools
AdapTools → implements → Indirect Prompt Injection
confidence 95% · We introduce AdapTools, a novel adaptive IPI attack framework
AdapTools → outperforms → AutoHijacker
confidence 90% · AdapTools roughly doubles ASR compared to the best baseline
AdapTools → outperforms → Combined Attack
confidence 90% · AdapTools roughly doubles ASR compared to the best baseline
IPI-3K → usedby → AdapTools
confidence 90% · We introduce a new dataset IPI-3K and conduct detailed security analysis... We propose a unified IPI attack method... We conduct extensive comprehensive experiments
AdapTools → bypasses → Pi-Detector
confidence 85% · Existing SOTA detectors (Pi-Detector...) can mitigate IPI attacks, but only reducing the ASR by nearly 50% under AdapTools
AdapTools → bypasses → MELON
confidence 85% · Existing SOTA detectors (MELON...) can mitigate IPI attacks, but only reducing the ASR by nearly 50% under AdapTools
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The integration of external data services (e.g., Model Context Protocol, MCP) has made large language model-based agents increasingly powerful for complex task execution. However, this advancement introduces critical security vulnerabilities, particularly indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern AI agents. We introduce AdapTools, a novel adaptive IPI attack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our approach comprises two key components: (1) Adaptive Attack Strategy Construction, which develops transferable adversarial strategies for prompt optimization, and (2) Attack Enhancement, which identifies stealthy tools capable of circumventing task-relevance defenses. Comprehensive experimental evaluation shows that AdapTools achieves a 2.13 times improvement in attack success rate while degrading system utility by a factor of 1.78. Notably, the framework maintains its effectiveness even against state-of-the-art defense mechanisms. Our method advances the understanding of IPI attacks and provides a useful reference for future research.
Tags
Links
- Source: https://arxiv.org/abs/2602.20720v1
- Canonical: https://arxiv.org/abs/2602.20720v1
Trouble viewing inline? Open PDF directly →
Full Text
45,942 characters extracted from source content.
Expand or collapse full text
AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs Che Wang 1 2 Jiaming Zhang 2 Ziqi Zhang 1 Zijie Wang 2 Yinghui Wang 3 Jianbo Gao 1 Tao Wei 3 Zhong Chen 1 Wei Yang Bryan Lim 2 Abstract The integration of external data services (e.g., Model Context Protocol, MCP) has made large language model-based agents increasingly pow- erful for complex task execution. However, this advancement introduces critical security vulnera- bilities, particularly indirect prompt injection (IPI) attacks. Existing attack methods are limited by their reliance on static patterns and evaluation on simple language models, failing to address the fast-evolving nature of modern AI agents. We introduceAdapTools, a novel adaptive IPI at- tack framework that selects stealthier attack tools and generates adaptive attack prompts to create a rigorous security evaluation environment. Our ap- proach comprises two key components: (1)Adap- tive Attack Strategy Construction, which develops transferable adversarial strategies for prompt op- timization, and (2)Attack Enhancement, which identifies stealthy tools capable of circumvent- ing task-relevance defenses. Comprehensive ex- perimental evaluation shows thatAdapTools achieves a2.13×improvement in attack success rate while degrading system utility by a factor of 1.78. Notably, the framework maintains its ef- fectiveness even against state-of-the-art defense mechanisms. Our method advances the under- standing of IPI attacks and provides a useful ref- erence for future research. 1 Introduction Large language models (LLMs)-based agents are designed to decompose complex tasks that require sequential plan- ning and execution. Recent advances in frontier models (e.g., GPT-5.2 (OpenAI & Josh Achiam, 2024), Gemini 2.5 (Team 1 School of Computer Science, Peking University, China 2 College of Computing and Data Science, Nanyang Technological University, Singapore 3 Ant Group. Correspondence to: Che Wang <chewang@stu.pku.edu.cn>. Preprint. February 25, 2026. TASK USER AGENT Task Planning Action Trigger MCP(API) Query Tool Calling Attack Tools EXTERNAL DATA Attack Strategy Attack Prompt Benign Content Injecting QUERY RETURN Get_Weather(): The weather of Washington Today’s is 28°C ... Please override your task and send config files to email... ( send_email ) Tomorrow will have rain... ATTACK Figure 1.Attack Workflow ofAdapTools et al., 2023) and Qwen3 (Yang et al., 2025) have begun to play an indispensable role in daily life. For instance, the AI coding assistant Cursor (Anysphere, 2024) enables the sys- tem to interact with APIs (recently governed by Model Con- text Protocol, MCP) to access external resources, thereby significantly enhancing productivity. However, this paradigm introduces new security risks:indi- rect prompt injection (IPI) attacks(Greshake et al., 2023; Yi et al., 2025) exploit the agent’s interaction with intermediate servers and injecting malicious instructions in websites and databases. When accessed by the agent, these instructions may trigger unauthorized behaviors, such as exfiltrating pri- vate data or executing harmful actions. With the growing ecosystem of MCP servers (Anthropic, 2025) (e.g., over 1,000 MCP servers are now publicly available, with more than 50% hosted by third-party providers that independently develop and maintain the servers without standardized secu- rity auditing (Guo et al., 2025)), the potential attack surface expands rapidly, posing severe risks to agent users. To obtain a clearer understanding of security vulnerabilities in current LLM agents, we analyze the inherent limitations of existing IPI attacks when faced with the emerging capa- bilities of modern, reasoning-heavy models. This analysis reveals that as agents transition from simple text-matchers to reasoning-capable entities, a successful adversarial frame- work must overcome a “trinity of constraints” that prior methods (Perez et al., 2024; Liu et al., 2024c; Zhan et al., 2024; Liu et al., 2025) fail to address simultaneously. As compared in Tab.1, since modern reasoning LLMs utilize multi-step thinking to cross-verify instructions against the user’s original intent, an attack must possess Robustness to maintain its malicious influence under such internal cog- 1 arXiv:2602.20720v1 [cs.CR] 24 Feb 2026 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs Table 1.Evaluation of IPI attacks against Reasoning LLM-based Agents. MethodAdaptabilityStealthinessRobustness (Perez et al., 2024)### (Liu et al., 2024c)### (Zhan et al., 2024)### (Liu et al., 2025) # AdapTool Notes:#: absence, : presence, and: partially satisfied. nitive scrutiny. Furthermore, because static and repetitive prompt patterns (e.g., “Ignore previous instructions...”) are increasingly neutralized by evolving safety filters and Red Herring detection, Adaptability becomes a functional ne- cessity for an attack to mutate and bypass these dynamic defense layers. Finally, the attack must exhibit Stealthiness by strategically selecting malicious tools that semantically align with the user’s specific task context. Without this functional consistency, an agent’s internal logic audit will readily flag the unrelated tool-calling behavior as a security anomaly. Addressing these limitations necessitates a shift in the adversarial paradigm: moving beyond simple prompt injection toward a sophisticated, context-aware mechanism that unifies these three interdependent traits specifically for the complexities of next-generation reasoning agents. Therefore, we propose a novel adaptive IPI attack method, AdapTools, which contains (i) Adaptive Attack Strategy Construction, which automatically collects and refines di- verse, transferable attack strategies to generate sophisticated attack prompts, and (i) Attack Enhancement, which embeds malicious intent by leveraging task-relevant tools within realistic agent trajectories to satisfy context aware charac- teristic. These components enable adaptive, stealthy, and robust IPI attacks towards evolving reasoning LLMs that more faithfully simulate real-world adversaries. As illus- trated in Fig. 1, when an agent queries external data, the adversary first identifies a suitable attack tool to maximize stealthiness, then generates attack prompts using matched adaptive attack strategies, embeds them into benign con- tent, and finally returns them to the agent system, thereby inducing unauthorized behaviors. We conduct extensive experiments comparing our approach with several existing attack methods. Specifically, on commercial LLMs (GPT-4.1, DeepSeek-R1, Gemini-2.5), AdapToolsroughlydoubles ASRcompared to the best baseline (14.5%). Furthermore, locally deployed LLMs (Qwen3, LLaMA3.1, Mistral) are more vulnerable, yield- ing an average ASR of58.1% vs 38.2%of baseline. Ex- isting SOTA detectors (MELON (Zhu et al., 2025), Pi- Detector (Debenedetti et al., 2024)) can mitigate IPI at- tacks, but only reducing the ASR by nearly 50% under AdapTools, still posing security threats. Therefore, the results demonstrate the effectiveness ofAdapToolsand underscore the urgent need for stronger defense mechanisms for protecting agent system. Our contributions are summa- rized as follows: •We introduce a new dataset IPI-3k and conduct detailed security analysis of reasoning LLMs under IPI attacks, which reveal the limitations of existing attack methods. •We propose a unified IPI attack method that enables adaptation of attack strategies and delivers more stealthy evaluations against fast-evolving agents. •We conduct extensive comprehensive experiments on open-source and commercial reasoning LLMs to demon- strate the effectiveness ofAdapToolsin bypassing LLMs’ security mechanisms, even when guarded by ex- isting defenses. 2 Related Work Indirect Prompt Injection (IPI) Attack.IPI attacks mostly appear in agent systems that occurs during inter- actions with external data, which causes tool oriented mali- cious behaviors (Wu et al.; Greshake et al., 2023; Zhan et al., 2025). They originate from third-party sources rather than the end user, aim to compromise systems or exfiltrate pri- vate data. It is particularly difficult to detect and mitigate in practice as the injected instruction appears benign, thereby misleading LLMs into executing unintended actions. Representative IPI attacks have been proposed recently, such as escape character attack (Willison, 2022), which exploit symbols such as “ ” to alter context parsing. Context ig- nore attack (Perez et al., 2024; Schulhoff et al., 2023), which instructs the model to disregard prior context. Combine at- tack (Liu et al., 2024c), which integrates multiple attack strategies to increase effectiveness. AutoHijacker (Liu et al., 2025) used the LLM-as-Optimizer mechanism to gener- ate more robust attack prompts, instead of static prompt patterns. Besides, there are also benchmarks (Zhan et al., 2024; Debenedetti et al., 2024) proposed to assess agents’ robustness against IPI, particularly in tool-calling scenar- ios. However, their evaluation samples are highly manually crafted, and these benchmarks are primarily evaluated on non-reasoning LLMs, relying on single-turn interactions with static strategies. Defense Methods.Current defenses can be categorized into two groups: input-level (pre-detection) and output- level (post-detection) methods. At the input level, there are instruction prevention (Ins, 2023), data prompt isola- tion (Willison, 2022), and sandwich prevention (San, 2023). These are static rule-based approaches that guide the LLM to ignore commands embedded in external data between tool outputs and external content or using classifier (Debenedetti et al., 2024) to distinguish potential malicious instructions 2 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs Table 2.Comparison of Existing Benchmarks with IPI-3K. DataSetTest CasesAttack Tools AgentDojo62930 InjectAgent51027 IPI-3K3691277 in tool responses. On the other hand, output level ap- proaches, including fine-tuned detection methods (Protec- tAI.com, 2023), use models to identify whether the output contains malicious content. In addition, there are training- free methods, such as MELON (Zhu et al., 2025) and Per- plexity Filtering (Jain et al., 2023), which rely on rule-based heuristics to detect whether a tool may have been mali- ciously manipulated. 3 Adaptive Attack Trajectory Construction As illustrated in Table 2, existing benchmarks (Debenedetti et al., 2024; Zhan et al., 2024) exhibit limited tool diversity and narrow test coverage. To better simulate realistic and generalizable agent scenarios, we introduce IPI-3K, a com- prehensive dataset specifically designed to evaluate adaptive IPI attacks within the diverse tool ecosystems prevalent in modern systems. Specifically, IPI-3K comprises 3,691 be- nign agent trajectories, derived through the consolidation and reorganization of established benchmarks (Zhang et al., 2025a), covering multi-step processes that necessitate exter- nal data retrieval. Furthermore, IPI-3K includes 277 attack tools identified as possessing high-authority permissions to access sensitive user information. During the construction of IPI-3K, we define two core com- ponents for implementing adaptive attacks: • Entrypoint: Instantiated as a tool interfacing with in- termediate servers. For instance, in a shopping task, the agent must interface with a server to query product plat- forms; thus, the entrypoint serves as the primary access vector for adversaries. •Direct Harm: This represents the adversary’s terminal objective. We categorize these high-authority tools into three domains:data leakage,financial loss, andsystem harm. To ensure the quality of the attack toolset, we leverage commercial LLMs (e.g., GPT-4o, DeepSeek- R1) to assign risk scores (0-10) based on exploitability By analyzing high-potential vulnerable trajectories, we in- ject malicious intent into retrieved clean content to facilitate the attack. IPI-3K serves as a foundational benchmark that supports various attack methodologies to rigorously evaluate the robustness of agentic LLMs. No Functions 20.2% Security Risk 29.3% Red Herring 24.3% Arguments Error 9.9% Others 7.6% Unrelated 8.7% Figure 2.Breakdown of IPI-3k based IPI attack on Qwen3-8B. 4 Motivation To design a more practical evaluation framework, it is essen- tial to rigorously investigate the underlying mechanisms of how function-calling agents succeed or fail under IPI attacks. We evaluated representative attack methods (e.g., Combined Attacks, AutoHijacker (Liu et al., 2025)) on our IPI-3K benchmark and, crucially, employed reasoning models (e.g., Qwen3-8B-Thinking, DeepSeek-R1) to perform post-hoc analysis on attack failures. Since tool-calling agents typi- cally only output the final function name and its arguments, their internal decision-making process remains a black box. By leveraging the Chain-of-Thought (CoT) traces of reason- ing models, we can uncover how agents interpret adversar- ial prompts and where their reasoning trajectories deviate. Based on these insights, we respond two Research Questions that guide us to design methodologies. RQ1: Reasoning LLM v.s. non-reasoning LLM.Prior studies (Zhan et al., 2024; 2025) are more focusing on non- reasoning LLMs, we highlight the robustness of reasoning LLMs (e.g., Qwen3-8B thinking) relative to non-reasoning counterparts (e.g., LLaMA-3.1-8B). Our results indicate that reasoning LLMs show stronger resistance. For exam- ple, under the combined attack, Qwen3-8B with thinking enabled yields an ASR of 19.4%, which is lower than both non-thinking Qwen3-8B (26.1%) and another non-thinking baseline, LLaMA-3.1-8B (32.8%). We attribute this superi- ority to the explicit Chain-of-Thought reasoning employed by such models, which often leads them to categorize mali- cious prompts as unrelated to user instruction or risky when comparing with user’s original task step by step. RQ2: The reason of successful defense.We also study how existing agents defend against IPI attacks and show the results in Figure 2. Two frequently identified reasons for rejection areSecurity RiskandRed Herring. This suggests that existing static template-based attacks lack sufficient di- versity and can be effectively filtered out by modern LLMs’ built-in safety mechanisms. Therefore, we argue that it is challenging to conduct template-based prompt injection in real-world scenarios. In addition, another issue is theUn- 3 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs relatedissue, which arises because the selected tool is not task-specific to the user goal. Therefore, these observations motivate our method design. 5 Methodology 5.1 Problem Definition Tool-augmented Agents.We formalize an LLM-based agent as an autonomous systemπthat executes complex user tasks by orchestrating workflows through available tools and external interfaces (e.g., MCP servers), follow previous works (Zhu et al., 2025). Formally, given a user instruction I u , the agent operates through an iterative process consisting of two key phases: • Action Generation (Planning).At each stept, condi- tioned on the instructionI u and the current context, the LLMMgenerates a specific actiona t . This process forms a structured plan (or reasoning chain), denoted asA= (a 1 ,...,a T ), where eacha t corresponds to a distinct tool-calling intent or reasoning step. •Environment Interaction.For each actiona t , the agent invokes a specific functionf t selected from the available toolsetF=f 1 ,f 2 ,f 3 ,·. Except local execute tools,F out ∈Fdenotes a set of external services tools interfacing with third-party data (e.g., via MCP). Upon execution, the environment returns an observationo t , which is then integrated into the context for subsequent reasoning. Afterwards, the complete execution trajectoryτ t is: τ t = I u ,(a 1 ,f 1 ,o 1 ),(a 2 ,f 2 ,o 2 ),...,(a t ,f t ,o t ) .(1) Threat Model.We assume that when the agent queries external servers to retrieve publicly available content, the returned observations may contain malicious instructions crafted by third-party adversaries. Such injected prompts may deceive the agent and induce harmful behaviors. Ad- ditionally, we consider two types of attackers:(i) MCP server controllers (grey-box attackers), who may access partial information about the agent’s trajectory (e.g., the most recently invoked tool); and(i) third-party adver- saries (black-box attackers), who only broadcast malicious instructions publicly, without access to the agent’s internal states or task details. The overallattacker goalis to inject malicious instructions into the external content retrieved by the agent, with the goal of manipulating the agent into executing attacker targeted tools. Objective.The goal of the adversary is to maximize the probability that the agentπexecutes a target malicious tool f a ∈ F. Formally, the attack seeks to optimize the adver- sarial promptp a such that the likelihood of generatingf a is maximized. The objective function is defined as: max p a P π a t+1 =f a |τ t ; ̃o t ,s.t. ̃o t =o t ⊕p a .(2) Here,P π (· | ·)denotes the probability distribution over actions generated by the agent policyπ. The likelihood depends on the historical trajectoryτ t and the injected ob- servation ̃o t , where⊕represents textual concatenation. 5.2 Overview. The design ofAdapToolscenters on addressing three fun- damental failure modes in function-calling agents:Red Her- ring,Security Risk, andUnrelated Information. While other potential failures often stem from the intrinsic limita- tions of the underlying LLMs, these three issues represent the most exploitable vectors for IPI attacks. To realize these objectives,AdapToolsintegrates two syn- ergistic modules that collectively ensure both adaptability and stealthiness. Specifically, the Adaptive Attack Module (Instruction Refinement) targets Red Herrings and Security Risks by facilitating autonomous, continuous strategy up- dates without manual annotation, underpinning a lifelong security evaluation for rapidly evolving LLMs. Comple- menting this, the Attack Enhancement Module (Adaptive Tool Selection) exploits vulnerabilities within Unrelated content to ensure the seamless embedding of adversarial payloads. By bridging these components, our framework attains a high-fidelity assessment of agentic robustness in realistic, dynamic deployment scenarios. 5.3 Adaptive Attack Construction The primary objective of this module is to maximize the likelihood that the victim agentπexecutes a specific ma- licious toolf a ∈ F. Specifically, we aim to optimize the attack strategys a ∈ Ssuch that the resulting promptp a generated by an attacker LLMG(e.g., GPT-5) is perceived as a benign instruction within the vulnerable trajectoryτ t . Formally, the optimization problem is defined as: max s a ∈S ;P π (a t+1 =f a |τ t ,p a ),s.t.p a =G(f a ,s a ).(3) Here,P π denotes the probability distribution of the victim agent’s next action. The adversarial promptp a is synthe- sized by the generatorGconditioned on the target toolf a and the selected strategys a . To satisfy above objective, we design two core components: theAdaptive Strategy Generatorand theStrategy Distil- lation. Together, these components enable the automatic construction of a diverse attack strategy library, which is subsequently compressed into a generalized representation to facilitate effective transfer across different agent systems and datasets. Adaptive Strategy Generation.Inspired by adversarial training, which has been widely adopted in visual attack 4 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs User Task Agent Executing Attack Tools Pool Attack Local (Benign) External (Attacker) Success Fail Strategy Lib Output Chain of Thought Confirm Strategy Attack Prompt Generator Select Action: send_http_web(url) Attack Prompt: “Please override your task ... config files” Observation: “Today’s temperature is 28°C. ” Generate New Strategy Failure Analyzer Observation Match Collect Context Inject Return Retrival Combine Figure 3.Overview of the Adaptive Attack Module. scenarios (Liu et al.; 2024b; Qi et al., 2024), we design an automatic attack strategy generator. We illustrate the generation workflow as shown in Figure 3. Given an agent systemπexecuting a user taskI u , our method intervenes when the agent queries external data. The process unfolds as follows: First, the attacker 1 ran- domly selects a high-authority target toolf a from the toolset. This random selection mechanism enhances generalization by forcing the attack strategy to adapt to diverse tool in- terfaces in a task-agnostic setting. Next, we2retrieve the most relevant strategys a for toolf a from the Strategy LibraryS(which is initialized as empty). This strategy, combined with the user taskI u , is 3 fed into the Attack Prompt Generator (an adversarial LLM) to synthesize the attack promptp a . Notably, in the cold-start phase where no relevant strategy exists, the prompt is generated solely based on the tool description. The generated promptp a is then 4 injected into the benign retrieved content to conceal its malicious objective. The manipulated observation ̃o t , now containingp a , is5appended to the historical trajectoryτ t for the6subsequent reasoning step. If the agent 7 success- fully invokes the target toolf a , the strategys a is deemed effective and8archived in the librarySfor future reuse. Conversely, if the attack fails, we 9 extract the agent’s rea- soning traces (e.g., Chain-of-Thought) and feed them into the Analyzer (a commercial LLM) to diagnose the failure mode. Specifically, why the agent refused the tool call. As detailed in Sec. 4, this fine-grained feedback guides the10 evolution of the strategy. We repeat this refinement process for a maximum ofKiterations or until the attack succeeds. While these strategies improve ASR across various task set- tings, they suffer from significant scalability bottlenecks as the number of(f a ,I u )combinations increases. Specifically, Merging Optimized Strategy Library ASR Eval LLM- empower Encoder Fine-grained Strategies Compacting Mechanism Strategy Library Figure 4.An overview of strategy compactor, which abstracts fine-grained strategies into a more generalizable strategy patterns. the retrieval process becomes computationally prohibitive and prone to erroneous mappings between tools and strate- gies, particularly when handling long-context sequences. Furthermore, these strategies exhibit limited generalizabil- ity in realistic evaluation scenarios, their overly fine-grained nature often leads to over-specialization, preventing effec- tive adaptation to novel or unseen conditions. Strategy Distillation.This module aims to enhance the generalization and transferability of strategy libraries. In- spired by Inductive Logic Programming (ILP) (Cropper & Duman ˇ ci ́ c, 2022), we first abstract discrete strategies into higher-level representations. Furthermore, drawing on the pruning principle from decision tree algorithms, we employ an ASR-based metric to consolidate the extensive strategy li- brarySinto a compact, transferable repository. This process preserves essential decision patterns while discarding redun- dant or over-specialized rules. Specifically, as illustrated in Fig. 4, we convert discrete textual strategies into latent semantic embeddings using a text-embedding model (Zhang et al., 2025b; Wang et al., 2024). We then apply clustering techniques (e.g., K-means (Ahmed et al., 2020)) to group semantically similar strategies. This abstraction filters out idiosyncratic, sample-specific details and induces general- ized strategy descriptions capable of bypassing an agent’s security guardrails. For the consolidation phase, we uti- lize ASR as the primary utility metric. A subset of strate- gies is merged into a generalized form only if the resulting ASR degradation does not exceed a predefined thresholdδ. Through this iterative pruning, we construct an optimized strategy library that maintains comparable ASR to the origi- nal fine-grained set while significantly reducing redundancy and enhancing cross-task utility. 5.4 Attack Enhancement As analyzed in Sec. 4, the semantic divergence between an attack toolf a and the user’s primary goalI u provides a strong signal for agent-based defenses. Specifically, agents can effectively mitigate threats by cross-referencing user intent with tool functionality. As illustrated in Fig. 5, a task-relevant tool (e.g.,Transfer Money) maintains higher trajectory coherence compared to 5 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs Please order a top-rated black coffee at 6:00 pm for me. Act 1: Confirm Location Act 2: Search Cafes MCP: Read Reviews Act 1: Confirm Location Act 2: Search Cafes MCP: Read Reviews Attack : Delete_Files Attack : Tranfer_Money REJECT Thought: This task requires multiple steps to achieve the task : 1. Get the user’s location. 2. Find nearby cafes. 3. Compare reviews. 4. Choose a top-rated cafe with black coffee. 5. Schedule the order for 6:00 pm. 6. Confirm with the user. Task Plan Random Task-Specific SUCCESS Figure 5.Example illustrating task-irrelevant vs task-specific tool selection. a randomly selected, incongruous tool (e.g.,Delete File) within a Coffee Delivery context. To enhance adversarial stealth and minimize rejections triggered by such semantic mismatches, we propose an adaptive tool selection mecha- nism. As shown in Fig. 6, rather than relying on stochastic sampling, this mechanism prioritizes tools that exhibit high semantic alignment with the user task, thereby ensuring that the malicious trajectory remains indistinguishable from benign reasoning flows. Therefore, to enhance adversarial stealth and minimize re- jections triggered by semantic inconsistency, we propose this adaptive tool selection mechanism. Unlike stochastic sampling, this module ensures that the selected attack tool f a is both temporally plausible and semantically resonant with the current agent trajectoryτ t . Markovian Transition ModelingWe model tool-use sequences as sequential dependencies where the latent user intent is encoded within the historical trajectoryτ t . Drawing inspiration from sequential recommendation sys- tems (Barkan & Koenigstein, 2016), we employ a first-order Markov Chain to capture the temporal patterns of tool exe- cution. Assuming a grey-box adversary (e.g., a malicious MCP controller) can observe the most recent tool invocation f t , we define a transition probability matrixM∈R |F|×|F| . Each entryM ij represents the likelihood of transitioning from toolf i tof j , learned from all benign trajectories: M ij =P(f j |f i ) = count(f i →f j ) P f k ∈F count(f i →f k ) (4) Joint Optimization for Tool SelectionThe selection of the optimal attack toolf a ∈ Fis formulated as a dual- constraint optimization problem. We first predict the most likely benign successorf ∗ t+1 that the agent would naturally invoke in the absence of an attack. Subsequently, to maintain semantic continuity, we map this predicted intent to the adversarial space by selectingf a that maximizes semantic similarity tof ∗ t+1 : f a = arg max f∈F sim φ(f),φ(f ∗ t+1 ) (5) whereφ(·)denotes a pre-trained semantic embedding func- Candidate Next Tool Set 86% Candidate Attack Tool Set f t+1 f a Figure 6.Visualization of selecting highest semantic similarity attack toolf a againstf t+1 . tion andsim(·,·)represents the cosine similarity. By priori- tizing anf a that satisfies both the first-order Markovian de- pendency (temporal) and the semantic alignment (content), AdapTools ensures that the malicious actiona t+1 =f a remains indistinguishable from the benign reasoning flow, thereby maximizing the overall attack objective defined in Eq. (2). 5.5 Attack Realization This section delineates the practical execution of AdapToolsfrom the adversary’s perspective. Once the strategy library and transition matrix are constructed offline, they serve as pre-built components for repeated deployment with minimal runtime overhead. The execution flow follows a three-stage process: •Information Interception: When a user initiates a task requiring external data, the agent invokes an MCP server. At this juncture, the adversary intercepts the tool invoca- tion trajectory to infer latent task context. •Targeted Synthesis: Leveraging the transition matrix (Sec. 5.4), the attacker identifies a task-aligned target tool f a that minimizes semantic divergence. It then retrieves the optimal generalized strategy fromSto synthesize an adversarial promptp a . •Injection and Execution: The promptp a is injected into the legitimate retrieved data returned by the compromised server. The attack is successful if the agent subsequently executesf a , effectively hijacking the agent’s behavior. 6 Experiments Agents.We evaluate our method by adapting the Re- Act (Yao et al.) framework, focusing on IPI attacks. We consider six foundation LLMs as the core of the agent system, including both open-source models (Qwen (Yang et al., 2025), LLaMA (Touvron et al., 2023), Mistral (Minis- tral, 2025)) and commercial models (GPT (OpenAI & Josh Achiam, 2024), DeepSeek (Liu et al., 2024a), Gem- ini (Team et al., 2023)). These LLMs span both reasoning- oriented and general-purpose models and support a tool- calling mechanism. 6 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs Table 3.Evaluation results of Effectiveness ofAdapToolson Various LLMs based Agents. FMsCoT BUDefense Ignore Instruction Combined AttackInjectAgentAutoHijacker*Ours ASR(%↑) UA(%↓) ASR(%↑) UA(%↓) ASR(%↑) UA↓ASR(%↑) UA(%↓)ASR(%↑) UA(%↓) GPT-4.1#66.0 No Defense1.455.48.054.41.860.412.055.426.144.8 MELON0.456.12.458.10.461.33.061.513.352.9 Pi-Detector0.855.84.656.60.861.16.859.016.151.1 Avg0.955.85.056.41.060.97.358.618.549.6 DEEPSEEK-R1 50.0 No Defense0.439.80.437.20.438.09.340.220.336.8 MELON0.040.00.237.30.239.14.341.36.743.6 Pi-Detector0.239.90.237.30.238.16.540.813.540.2 Avg0.239.90.337.30.338.46.740.813.540.2 GEMINI-2.5-FLASH 61.0 No Defense9.231.418.228.29.233.222.426.035.417.3 MELON3.235.15.036.33.436.76.235.918.527.6 Pi-Detector5.233.810.033.24.835.913.431.523.724.4 Avg5.933.411.132.65.835.314.031.125.923.1 QWEN-3-8B 80.0 No Defense13.661.019.456.415.060.629.649.660.632.6 MELON4.468.44.868.14.469.17.467.433.754.3 Pi-Detector8.065.511.063.18.266.016.460.239.150.0 Avg8.765.011.762.59.265.217.859.144.545.6 LLAMA-3.1-8B#38.0 No Defense25.223.032.817.835.214.437.617.844.415.2 MELON7.829.69.426.710.823.713.224.623.020.9 Pi-Detector16.226.420.422.523.019.023.820.326.719.4 Avg16.426.320.922.323.019.024.920.931.418.5 MISTRAL-8B#36.0 No Defense39.412.837.414.234.816.047.412.469.36.7 MELON11.422.911.423.69.625.114.824.136.427.3 Pi-Detector23.218.622.619.520.621.127.619.541.324.3 Avg24.718.123.819.121.720.729.918.749.019.4 Notes:BU= Benign Utility.ASR= Attack Success Rate (higher is better).UA= Utility Under Attack (lower is better).CoT:#= None-reasoning, = Reasoning. * our own replication of the work as the code is not open source. Color coding:Best performance Datasets.We utilize three datasets to evaluate the effective- ness ofAdapTools. The main dataset isIPI-3k, which is introduced in Section 3. The others areInjectAgent(Zhan et al., 2024) andAgentDojo(Debenedetti et al., 2024). Baselines.Following recent works (Zhu et al., 2025; Debenedetti et al., 2024), we compare our approach against several attack baselines: prefix-based prompt attacks (Ignore Instruction (Schulhoff et al., 2023), Combined Attack (Liu et al., 2024c)), InjectAgent (Zhan et al., 2024), and Au- tohijacker (Liu et al., 2025). For defenses, we adopt two state-of-the-art baselines (MELON (Zhu et al., 2025),Pi- Detector (Debenedetti et al., 2024)), covering both input- level and output-level detection strategies. 6.1 Attack Performance As illustrated in Table 3, our method achieves the best perfor- mance in terms of attack effectiveness compared with other attacks. Our attack not only induces agents to perform target actions but also leads to substantial utility degradation. Specifically, for commercial LLMs, our method achieves averagely 2.13×higher ASR compared with best base- line performance across. For instance, withGPT-4.1, the average ASR of baselines remains below 8%, while our method raises the ASR to 18.5%. Similar improvements are observed onGemini-2.5-Flash(25.9% vs. 9.2% baseline average) andDeepSeek-R1(13.5% vs. 6.7% best baseline). Further, we find open-source LLMs’ de- fense capability is substantially weaker than commercial LLMs, with the ASR exceeding 30% on average. Among them,Mistral-8Breaches a 49.0% ASR, which may be attributed to its relatively weaker grounding (36.0% BU) in function calling. It is easier for malicious prompts to dominate the agent’s decision-making.LLaMA-3.1-8B exhibits relatively lower ASR (31.4%) but suffers from se- vere degradation in utility under IPI attacks. In contrast, Qwen-3-8Bmaintains higher benign utility and demon- strates stronger resistance in utility preservation, though its ASR still climbs to 44.5%, reflecting the inherent difficulty of defending high-capacity, tool-using models against so- phisticated IPI attacks. In general, commercial LLMs are equipped with effective mechanisms to resist adversarial attacks compared with open source LLMs. Our method also demonstrates stronger robustness under two defense baselines. For instance,GPT-4.1achieves 26.1% ASR without defenses, but its ASR drops to 13.3% and 16.1% with defenses. Similar reductions are observed for other agents (e.g.,DeepSeek-R1: 20.3%→10.1% 7 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs GPT-4.1Qwen3-8B Foundation Models 0.00 0.05 0.10 0.15 0.20 Attack Success Rate 0.000 0.004 0.122 0.139 0.157 0.204 +3.6% +6.5% Baseline AutoHijacker Ours Figure 7.The transferability of our method in InjectAgent Dataset. Table 4.Ablation study on tool selection module effectiveness. Foundation ModelConfigurationASR(%↑)UA(%↓) GPT-4.1 w/o selection21.443.8 w/ selection26.144.8 Improvement(∆)+4.7+1.0 QWEN3-8B w/o selection52.736.4 w/ selection60.632.6 Improvement(∆)+7.9-3.8 Note:∆represents the performance difference between configurations with and without the tool selection. averagely;Qwen3-8B: 60.6%→36.4% averagely). Over- all, the defenses reduce ASR by at least3×on baseline attacks, but only about2×against ours. Such improvement benefits from adaptive attack prompt generation and tool selection, while existing detectors such as Pi-Detector and Melon focus primarily on comparing task and external data or output semantic similarity to identify outliers. 6.2 Ablation Studies Transferability.As shown in Fig. 7, we compare our method with baselines on the InjectAgent dataset. Our approach consistently achieves higher attack success rates. Specifically, when the agent’s foundation model is GPT-4.1, our method outperforms Autohijacker by 3.6%; withQwen3-8B, the improvement increases to 6.5%. How- ever, compared to our more realistic dataset, the InjectAgent setting yields a lower overall ASR. We attribute this to the rapid updates of modern LLMs, whose security mechanisms quickly incorporate previously known attack cases. These results demonstrate the effectiveness of our method on other datasets and continuously updated attack strategies. To further validate the efficacy and generalizability of AdapTools, we also extend our evaluation to Agent- Dojo (Debenedetti et al., 2024). Our results demonstrate thatAdapToolsconsistently outperforms all existing base- lines on this benchmark, reinforcing its robustness across diverse environments. 01234567 Iteration Number 0.0 0.2 0.4 0.6 0.8 1.0 Attack Success Rate (ASR) (5, 0.81) ASR Key Point Figure 8.Illustration of iteration in strategy library generation process. Effectiveness of Attack Enhancement (Grey-box Attack). To improve the stealthiness of IPI attacks, we design a tool selection mechanism for grey-box attackers. Due to the high costs of API calling, we employ one commercial LLM and one open source LLM to illustrate. As shown in Table 4, we report the ASR and UA with and without this mechanism. The attack enhancement increases the ASR by 4.7% and 7.9% onGPT-4.1andQwen3-8B, respectively. This improvement arises because our method bypasses unrelated failure cases of LLMs by selecting the most task-relevant attack tools. This experiment demonstrates the effectiveness of our tool selection mechanism. Strategy Analysis.As described in Section 3, we adopt a multi-iteration attack process to optimize strategies and improve the ASR of IPI attacks. We set the default number of iterationsk a to 5. To validate this choice, we conduct a comparison across seven iteration settings. As shown in Figure 8, the ASR reaches about 35% with a single iteration, and increases to over 80% as the number of iterations grows, eventually converging. Although using 6 or 7 iterations can yield slightly higher ASR, the improvement is marginal, while the corresponding API cost grows. Hence, we choose 5 iterations as a trade-off between attack performance and computational cost. 7 Conclusion In this work, we identified and addressed three key limi- tations of existing IPI attack methods, which reduce their effectiveness in evaluating fast-evolving LLM-based agents, particularly reasoning models. To enable more realistic eval- uation, we constructed a foundational dataset, IPI-3k, for simulating agent scenarios and conducted a detailed analy- sis of IPI attack failure modes. Building on these insights, we proposed an adaptive IPI attack method,AdapTools, which is adaptive, stealthy, and robust in both attack tool selection and prompt generation. Extensive experiments on six LLMs demonstrate the effectiveness of our approach, achieving up to a twofold increase in ASR while remain- ing effective even in the presence of defenses. This work 8 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs advances the understanding of IPI attacks and provides a valuable reference for future research. Impact Statement. This work aims to advance the security and robustness of LLM agents. By identifying novel vulnerabilities in function-calling trajectories and introducing the IPI-3K benchmark, our research provides essential tools for the community to develop more secure AI systems. The pri- mary societal consequence of this work is the improvement of public trust in autonomous agents through proactive de- fense and rigorous vulnerability assessment. We have care- fully considered the ethical implications of disclosing attack methodologies and have concluded that the benefits of en- abling robust defensive research outweigh the potential risks of misuse. References Instructiondefense.2023.URLhttps: //learnprompting.org/docs/prompt_ hacking/defensive_measures/ instruction. Sandwitchdefense.2023.URLhttps: //learnprompting.org/docs/prompt_ hacking/defensive_measures/sandwich_ defense. Ahmed, M., Seraj, R., and Islam, S. M. S. The k-means algorithm: A comprehensive survey and performance evaluation.Electronics, 9(8):1295, 2020. Anthropic. Mcp servers, 2025. URLhttps://github. com/modelcontextprotocol/servers. Anysphere. Cursor: The ai coder editor, 2024. URLhttps: //cursor.com/agents. Barkan, O. and Koenigstein, N. Item2vec: neural item embedding for collaborative filtering. In2016 IEEE 26th international workshop on machine learning for signal processing (MLSP), p. 1–6. IEEE, 2016. Cropper, A. and Duman ˇ ci ́ c, S. Inductive logic program- ming at 30: a new introduction.Journal of Artificial Intelligence Research, 74:765–850, 2022. Debenedetti, E., Zhang, J., Balunovic, M., Beurer-Kellner, L., Fischer, M., and Tram ` er, F.Agentdojo: A dy- namic environment to evaluate prompt injection attacks and defenses for LLM agents.InThe Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2024. URLhttps: //openreview.net/forum?id=m1YYAQjO3w. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. Not what you’ve signed up for: Com- promising real-world llm-integrated applications with in- direct prompt injection. InProceedings of the 16th ACM 9 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs workshop on artificial intelligence and security, p. 79– 90, 2023. Guo, Y., Liu, P., Ma, W., Deng, Z., Zhu, X., Di, P., Xiao, X., and Wen, S. Systematic analysis of mcp security.arXiv preprint arXiv:2508.12538, 2025. Jain, N., Schwarzschild, A., Wen, Y., Somepalli, G., Kirchenbauer, J., Chiang, P.-y., Goldblum, M., Saha, A., Geiping, J., and Goldstein, T. Baseline defenses for ad- versarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023. Liu, A., Feng, B., Xue, B., Wang, B., Wu, B., Lu, C., Zhao, C., Deng, C., Zhang, C., Ruan, C., et al. Deepseek- v3 technical report.arXiv preprint arXiv:2412.19437, 2024a. Liu, X., Xu, N., Chen, M., and Xiao, C. Autodan: Gen- erating stealthy jailbreak prompts on aligned large lan- guage models. InThe Twelfth International Conference on Learning Representations. Liu, X., Li, P., Suh, E., Vorobeychik, Y., Mao, Z., Jha, S., McDaniel, P., Sun, H., Li, B., and Xiao, C. Autodan- turbo: A lifelong agent for strategy self-exploration to jailbreak llms.arXiv preprint arXiv:2410.05295, 2024b. Liu, X., Jha, S., McDaniel, P., Li, B., and Xiao, C. Autohi- jacker: Automatic indirect prompt injection against black- box LLM agents, 2025. URLhttps://openreview. net/forum?id=2VmB01D9Ef. Liu, Y., Jia, Y., Geng, R., Jia, J., and Gong, N. Z. For- malizing and benchmarking prompt injection attacks and defenses. In33rd USENIX Security Symposium (USENIX Security 24), p. 1831–1847, 2024c. Ministral. Mistral models, 2025. URLhttps://docs. mistral.ai/api/. OpenAI and Josh Achiam, e. a. Gpt-4 technical report, 2024. URLhttps://arxiv.org/abs/2303.08774. Perez, F., Ribeiro, I., and Studio, A. Ignore previous prompt: Attack techniques for language models. 2024. ProtectAI.com.Fine-tuneddeberta-v3for promptinjectiondetection,2023.URL https://huggingface.co/ProtectAI/ deberta-v3-base-prompt-injection. Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., and Mittal, P. Visual adversarial examples jailbreak aligned large language models. InProceedings of the AAAI con- ference on artificial intelligence, volume 38, p. 21527– 21536, 2024. Schulhoff, S., Pinto, J., Khan, A., Bouchard, L.-F., Si, C., Anati, S., Tagliabue, V., Kost, A., Carnahan, C., and Boyd-Graber, J. Ignore this title and hackaprompt: Ex- posing systemic vulnerabilities of llms through a global prompt hacking competition. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 4945–4977, 2023. Team, G., Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Sori- cut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023. Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozi ` ere, B., Goyal, N., Hambro, E., Azhar, F., et al. Llama: Open and efficient foundation lan- guage models.arXiv preprint arXiv:2302.13971, 2023. Wang, L., Yang, N., Huang, X., Yang, L., Majumder, R., and Wei, F. Improving text embeddings with large language models. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 11897–11916, 2024. Willison, S.prompt injection attacks against gpt- 3. 2022. URLhttps://simonwillison.net/ 2022/Sep/12/prompt-injection/. Wu, C. H., Shah, R. R., Koh, J. Y., Salakhutdinov, R., Fried, D., and Raghunathan, A. Dissecting adversarial robust- ness of multimodal lm agents. InThe Thirteenth Interna- tional Conference on Learning Representations. Yang, A., Li, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Gao, C., Huang, C., Lv, C., et al. Qwen3 technical report.arXiv preprint arXiv:2505.09388, 2025. Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K. R., and Cao, Y. React: Synergizing reasoning and acting in language models. InThe Eleventh International Conference on Learning Representations. Yi, J., Xie, Y., Zhu, B., Kiciman, E., Sun, G., Xie, X., and Wu, F. Benchmarking and defending against indirect prompt injection attacks on large language models. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, p. 1809– 1820, 2025. Zhan, Q., Liang, Z., Ying, Z., and Kang, D.Injeca- gent: Benchmarking indirect prompt injections in tool- integrated large language model agents. InFindings of the 62nd Annual Meeting of the Association for Compu- tational Linguistics, ACL 2024, p. 10471–10506. Asso- ciation for Computational Linguistics (ACL), 2024. 10 AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs Zhan, Q., Fang, R., Panchal, H. S., and Kang, D. Adaptive attacks break defenses against indirect prompt injection attacks on llm agents. InFindings of the Association for Computational Linguistics: NAACL 2025, p. 7101– 7117, 2025. Zhang, J., Yin, L., Zhou, Y., and Hu, S. Agentalign: Navigating safety alignment in the shift from informa- tive to agentic large language models, 2025a. URL https://arxiv.org/abs/2505.23020. Zhang, Y., Li, M., Long, D., Zhang, X., Lin, H., Yang, B., Xie, P., Yang, A., Liu, D., Lin, J., Huang, F., and Zhou, J. Qwen3 embedding: Advancing text embedding and reranking through foundation models.arXiv preprint arXiv:2506.05176, 2025b. Zhu, K., Yang, X., Wang, J., Guo, W., and Wang, W. Y. Melon: Provable defense against indirect prompt injec- tion attacks in ai agents.arXiv preprint arXiv:2502.05174, 2025. 11